Skip to content

Commit

Permalink
Update events/syscall/potential_local_privillege_escalation_via_env_v…
Browse files Browse the repository at this point in the history
…ar_misuse.go

Co-authored-by: Federico Di Pierro <[email protected]>
Signed-off-by: Kapil Sharma <[email protected]>
  • Loading branch information
2 people authored and poiana committed Mar 28, 2024
1 parent 7592c8e commit 2f37d9a
Showing 1 changed file with 1 addition and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,9 @@ var _ = events.Register(PotentialLocalPrivillegeEscalation)

func PotentialLocalPrivillegeEscalation(h events.Helper) error {
// Set the GLIBC_TUNABLES environment variable
os.Setenv("GLIBC_TUNABLES", "glibc.tune.hwcaps=-WAITED,glibc.tune.secrets=2")

cmd := exec.Command("bash", "-c", "id")
cmd.Env = os.Environ()
cmd.Env = append(cmd.Env, "GLIBC_TUNABLES=glibc.tune.hwcaps=-WAITED,glibc.tune.secrets=2")

h.Log().Info("Process run with suspect environment variable which could be attempting privilege escalation")
err := cmd.Run()
Expand Down

0 comments on commit 2f37d9a

Please sign in to comment.